Judge Allows Claim That NFL App Violates Privacy by Disclosing Personal Data to Google

The National Football League has lost a bid to completely toss a class action that alleges it violates privacy laws by sharing the video watching habits of users of its mobile NFL App with Google for advertising and marketing purposes.

U.S. District Judge Mary S. McElroy in Rhode Island granted the request of the league affiliate NFL Enterprises LLC for dismissal of claims related to its app users watching of live content but allowed the action regarding claims related to watching of pre-recorded content.

The class action is being brought under the federal Video Privacy Protection Act and Rhode Island’s Video Rental Privacy Act. The VPPA prohibits video service providers from knowingly disclosing the personally identifiable information (PII) of its consumers to any person, with some exceptions. Similarly, the RIVRPA prohibits anyone from revealing, transmitting, publishing or disseminating “in any manner, any records which would identify the names and addresses of individuals, with the titles or nature of video films, records, cassettes, or the like, which they purchased, leased, rented, or borrowed.”

NFL Enterprises owns and operates the mobile NFL App, which disseminates “live local and primetime games, exciting videos and highlights, and replays of every game.” Consumers can download the NFL App through the Google Play Store on Android devices or the Apple App Store on iOS devices. Once downloaded, the NFL App requests permission from the users to access their location through the mobile device’s GPS. At no point does NFL Enterprises receive permission from users to share their location information, personally identifiable information, or video viewing information with third parties.

According to court documents, researchers engaged by plaintiff Daniel Louth, who used the NFL App from 2018 to 2021 in Rhode Island, revealed that NFL Enterprises transmits information sufficient to identify users and the videos they watch to an unrelated third party. Further, the analysis established that the NFL incorporates multiple APIs (application programming interfaces) into the NFL App that enable companies to open up their applications’ data and functionality to external third-parties. NFL Enterprises integrates the Anvato API, which is owned by Google, into the NFL App. When a user enables location services, NFL Enterprises transmits to Google, through the Anvato API, a user’s geolocation, a user’s advertising ID, and a unique video identifier of the videos the user viewed. The plaintiff alleges that the purpose of the Anvato platform is for NFL Enterprises to maximize its advertising revenue.

Louth says he never consented to or permitted the defendant to disclose his geolocation, advertising ID, and watch history to third parties. He alleges, on behalf of himself and a putative class, that in violation of the VPPA and RIVRPA, NFL Enterprises without consent “knowingly and intentionally discloses its users’ personally identifiable information—including a record of every video viewed by the user—to unrelated third parties.”

To state a claim under the VPPA, the judge said the plaintiff must establish that NFL Enterprises acted as a video tape service provider that knowingly disclosed PII to a third party. The VPPA defines PII to include “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”

Louth alleges that NFL Enterprises transmits to Google a consumer’s geolocation data at the time the consumer views videos. The app discloses a user’s geolocation within less than 40 feet of the user. The geolocation data disclosed, therefore, is “reasonably and foreseeably likely” to identify a user who watched videos on the NFL App, Louth claims.

Secondly, the plaintiff alleges that NFL Enterprises also discloses numerical information that attaches to a device such as a mobile phone so that third parties can track user activity across multiple applications. The data collected can allow companies to create inferences about the user’s identity, Louth claims.

The VPPA prohibits only “knowing” disclosures of PII. NFL Enterprises argues that while the plaintiff alleges facts regarding the analytics and ad targeting services that Google’s Anvato offers—which would require the PII disclosure—it does not set forth facts sufficient to reasonably infer that NFL Enterprises “actually used” such services.

But the judge noted that Google markets Anvato as providing “100% workflow automation” with nine distinct services in one product, including “monetization” and “analytics” for mobile applications. Also, the Avanto dashboard shows what information Google is collecting, analyzing and aggregating and this includes what users are watching and where they are watching.

By using these dashboards, the plaintiff asserts, NFL Enterprises knows that it is disclosing a user’s geolocation, device and watch history to Google. The court agreed, finding that given the facts alleged, it can reasonably be inferred that NFL Enterprises “knowingly” transmits PII for the purpose of targeted advertising.

The complaint further argues that the NFL violates privacy by disclosure of users’ PII when they are watching live game content and video clips, including prerecorded game highlights and other videos. But NFL Enterprises argued that the plain language of the VPPA, refers to the rental, sale, or delivery of “prerecorded video cassette tapes or similar audio visual materials.”

While plaintiff argued that live content should be included as a “similar audio visual material,” the court found this interpretation went too far.

The judge allowed NFL Enterprises’ motion to dismiss the plaintiff’s claims to the extent they rely upon the consumption of live content but denied the dismissal as to pre-recorded content.